关键词: 局域网攻击, 离散事件系统, 地址解析协议, 网络安全

Abstract:

Since the Address Resolution Protocol (ARP) is a stateless protocol and any IP-MAC pair sent by the host is accepted without authentication, it may be exploited by malicious hosts in a local area network. To solve this problem, a discrete event system for intrusion detection system for LAN attack is proposed in this paper. Using the active ARP detection to create different ARP events in the normal and attack state; and then constructing the discrete event system detector to detect the ARP events in the normal and attack state; Determine whether the LAN is in a normal or attacked state based on the detected ARP events. The scheme proposed in this paper is successfully implemented in the test platform.

Key words: local area network attack, discrete event systems, address resolution protocol, network security